After some difficulties with Cloudflare, we have spoken now with Sucuri (https://sucuri.net/). They offer malware removal, website firewall (providing DDoS protection among other things, requires DNS redirection to point to their firewalls) and site scanning (via local agent). All features independent (we can offer all or some).

We are thinking that a better approach to solving our customers problems when it comes to security and performance will be to offer (as add-ons) Sucuri (security centric and very focused on our most common apps) and MaxCDN (pure CDN focused on performance).

Any one has had experience with Sucuri? We have already tested (and in talks with them) and looks very promising.

Let us know thoughts on this (Sucuri + MaxCDN) approach (vs Cloudfront). We know this is well overdue and want to get it rolling.

I'm not convinced any cloud-based DDoS protection is effective against sophisticated attacks, since the server's actual IP address still faces the public internet and can often be discovered.

Ideally the infrastructure providers would make this standard (they could protect their whole operation and all customers with a single robust solution). It seems wrong to me that this is only occasionally offered, and as a premium service.

But since that's not likely to change anytime soon, what can Cloudways offer on the server-level? There must be options for this.

To repeat wahat surbma says, your secururi option is a non starter. It's not even something that could be considered because it's per site and not per server. Imagine having to put that on 100 different sites (which isn't even a lot)... that's 30,000/yr! It's insanity.

We believe the hosting provider / managed wp hosting should cover security so therefore we do not have to add a bloated security package on each application. This reduces the page loading speed significantly and the time it take to configure and manage each site reduces our client productivity. We have been considering other providers recently because of the above issue. We really hope you implement something soon or you will lose customers rapidly. Other competitors are also offering Cloudflare Railgun as a free service. This is a serious game changer!!

We have been using MAXCDN which is good but we are now interested in this solution as it is the cheapest and a reliable alternate = https://www.keycdn.com. I have seen several hosting companies integrate this service for free as a value added feature, along with free SSL (which you have already provided recently :) )

For small to medium traffic, I'm pretty sure Cloudfront will be a more cost efficient solution for most. For this add-on to be successful it needs to be affordable. If the add-on it doubles or triple the hosting cost it will probably not get so much traction. Hosting + Security still need to remain below the price of a fully managed premium hosting for it to be interesting.